Unencrypted MoviePass Database Exposes Sensitive Info From Thousands of Customers

Struggling movie ticket subscription service MoviePass stored thousands of customer card numbers and personal credit cards in a database that was not protected with a password, reports TechCrunch.

The exposed database, which contained 161 million records, was discovered by Mossab Hussain, a Dubai-based security researcher. Many of the records in the database were computer-generated logging messages, but some also featured sensitive user information like MoviePass customer card numbers.


MoviePass customer cards work like debit cards and are issued by Mastercard, allowing customers who sign up for MoviePass to use them to pay for the full cost of movie tickets.

In a sample of 1,000 records, TechCrunch found that a little over half contained unique MoviePass debit card numbers, expiration dates, and card balance. More than 58,000 records containing card data were found.

The unprotected MoviePass database also featured some customers' personal credit card numbers along with expiration dates, names, addresses, and other billing information. TechCrunch says that records contained enough information to allow someone to make fraudulent card purchases, though some records featured card numbers that were masked with the exception of the last four digits.

Email addresses and passwords related to failed login attempts were also found in the database.
We found hundreds of records containing the user's email address and presumably incorrectly typed password -- which was logged -- in the database. We verified this by attempting log into the app with an email address and password that didn't exist but only we knew. Our dummy email address and password appeared in the database almost immediately.
While Hussain contacted MoviePass CEO Mitch Lowe over the weekend, there was no response. MoviePass left the database online until Tuesday when TechCrunch contacted the company.

The database may have been accessible for months, but MoviePass did not respond to TechCrunch's questions about how long the server was exposed and whether it plans to disclose the incident to customers.

Hussain told TechCrunch that he questions why internal technical teams would be allowed to see critical data in plaintext, "let alone the fact that the dataset was exposed for public access by anyone."

Since its early 2018 launch, MoviePass has failed catastrophically. It ran out of money temporarily in mid-2018 because it was losing up to $40 million per month, and then began cutting back on the quality of service, limiting movie access, raising prices, and even temporarily shutting down.

Earlier this month, there were reports suggesting that MoviePass even went as far as changing the passwords of its most active users in an attempt to save money. Over the course of the last year, MoviePass has allegedly gone from three million subscribers to approximately 225,000.

Top Rated Comments

(View all)
Avatar
13 weeks ago
I jumped ship a LONG time ago when they started limiting and cutting. The funny thing, I haven't been back to the theaters once since. Greedy theaters that didn't want to partner lost all my business. Instead of being reasonable, they lost a lot more.
Rating: 8 Votes
Avatar
13 weeks ago
Yep, this company is a total joke. I dumped them 2 months after getting it.
Rating: 7 Votes
Avatar
13 weeks ago

Greedy theaters that didn't want to partner lost all my business. Instead of being reasonable, they lost a lot more.

Greedy theaters? Reasonable? MoviePass was selling you deeply discounted tickets that they were buying at full price, and your takeaway is that the tickets were overvalued? If I go bankrupt selling you dollar bills for 25 cents each, do you think that dollar bills are too expensive at normal prices, or that I had a terrible business plan.
Rating: 4 Votes
Avatar
13 weeks ago
Thank god I never took the bait and signed up for this cluster service.
Rating: 4 Votes
Avatar
13 weeks ago
I honestly thought this company was dead already
Rating: 2 Votes
Avatar
13 weeks ago
Why does this company still exist? Shouldn't it be six feet under by now? How can a company be such a complete cluster-****, lose millions and millions of dollars, and still be around to lose control of customer data?

It's frustrating to see this happen while so many good people are scraping by.
Rating: 1 Votes
Avatar
13 weeks ago
Well, I guess I was wrong when I last commented about Movie Pass over a year ago. They'll be remembered because of their data leaks.

If something seems too good to be true, it usually is. Most people saw this coming. Now MoviePass will fade into obscurity and be forgotten about.

Rating: 1 Votes
Avatar
13 weeks ago
It's just incredible that a company would still have such terrible data protection processes that this could happen but I find the tidbit buried at the end to almost as bad. I'd go read that article because "reports" could mean unsubstantiated rumors from a disgruntled employee but if they were changing passwords to block users that's inviting a lawsuit.

edit to add: that was a really interesting article. Amazing how much shenanigans was going on in the background at MoviePass
Rating: 1 Votes
Avatar
13 weeks ago
time and again, new companies show that they are lazy and clueless when it comes to securing customer data.
At this point it's pretty clear that this kind of crap will continue as long as humans and computers exist.
Lesson learned? Every newfangled Internet dependent service should be considered a security hazard.
Rating: 1 Votes
Avatar
13 weeks ago
The company changed their business model again... this time they're selling customer data for profit... I'm sure they'll revise the strategy again next week.
[doublepost=1566339456][/doublepost]

Earlier this month, there were reports ('https://www.businessinsider.com/inside-story-moviepass-rise-fall-2019-8') suggesting that MoviePass even went as far as changing the passwords of its most active users in an attempt to save money.

#murica
Rating: 1 Votes
[ Read All Comments ]